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Memorandum of Understanding between the Information 


Commissioner (ICO) and Transport for London (TfL) 


Introduction 


1. 


This Memorandum of Understanding (MoU) establishes a framework 
for co-operation and information sharing between Transport for 
London (TfL) and the Information Commissioner (the 
Commissioner) in connection with the sharing or relevant 
information and intelligence, set out at 18 to 23 below. It sets out 
the role of each organisation and documents the practical working 
level arrangements between the Commissioner and TfL. 


The Commissioner and TfL will monitor the operation of this 
memorandum and will review it, initially after one year from the 
date of this document, and subsequently from time to time as 
necessary. 


Any changes to this memorandum identified between reviews may 
be agreed in writing between the parties. 


Any issues arising in relation to this memorandum will be notified to 
the point of contact for each organisation (referred to in 24 below). 


This memorandum is a statement of intent that does not give rise to 
legally binding obligations on the part of either the Commissioner or 
TfL. 


The Role and function of The Information Commissioner 


6. 


The Commissioner is a corporation sole appointed by Her Majesty 
the Queen under the Data Protection Acts 1984 and 1998 to act as 
the UK’s independent regulator promoting public access to official 
information and protecting personal data. 


The Commissioner regulates the Data Protection Act 1998 (DPA), 
the Freedom of Information Act 2000 (FOIA), the Privacy and 
Electronic Communications (EC Directive) Regulations 2003 (PECR), 
the Environmental Information Regulations 2004 (EIR) and the 
INSPIRE Regulations 2009. The Commissioner is also the 
supervisory authority responsible for Regulation 2016/679 (the 
European General Data Protection Regulation), which will fully apply 
as of 25 May 2018. 


Section 51 of the DPA places a duty on the Commissioner to 
promote the following of good practice by data controllers and the 
observance of the requirements of the DPA by organisations. 


10. 


ide 


Where the Commissioner is satisfied that any of the data protection 
principles have been breached, a number of steps can be taken to 
seek to change the behaviour of the organisation including: 


ə» serving information notices requiring organisations to provide 
the Information Commissioner’s Office with specified 
information within a certain time period; 


e issuing undertakings committing an organisation to a 
particular course of action in order to improve its compliance; 


e serving enforcement notices where there has been a breach, 
requiring organisations to take (or refrain from taking) 
specified steps in order to ensure they comply with the law; 


e conducting consensual assessments to check organisations 
are complying; and 


e issuing monetary penalty notices, requiring organisations to 
pay up to £500,000 for serious breaches. 


Regulation 31 of PECR, as amended by the Privacy and Electronic 
Communications (EC Directive) (Amendment) Regulations 2011, 
provides the Commissioner with the power to serve enforcement 
notices and issue monetary penalty notices as above to 
organisations breaching PECR. This includes, but is not limited to, 
those breaching PECR by making unsolicited marketing calls, or 
sensing unsolicited electronic messages, in breach of regulations 19 
(automated calls), 21 (live calls) and 22 (text messages). 


The Commissioner may also prosecute those who commit criminal 
offences under the DPA. 


Functions and powers of Transport for London 


12. 


13: 


14. 


The Greater London Authority Act 1999 grants TfL wide statutory 
powers, to secure the provision of transport in London. TfL is also 
the highway and traffic authority for the Greater London area. TfL 
also has the broad licensing powers in relation to Taxi and Private 
Hire services in London. 


In the exercise of all of its broad powers, TfL is responsible for 
securing or facilitating the implementation of the Mayor’s transport 
strategy and his duties to “develop and implement policies for the 
promotion and encouragement of safe, integrated, efficient and 
economic transport facilities and services 


The policies of the Mayor’s draft Transport Strategy published in 
June 2017 included to: 


1. ensure London has a safe, secure, accessible, world-class taxi 
and private hire service with opportunity for all providers to 
flourish; 


2. enhance London’s streets and public transport network so as to 
enable all Londoners, including disabled and older people, to 
travel spontaneously and independently, making the transport 
system navigable and accessible to all; and 


3. provide an attractive whole-journey experience that will 
encourage greater use of public transport, walking and cycling. 


Cooperation between the Commissioner and TfL 


15. 


16. 


T7: 


Subject to any legal restrictions on the disclosure of information 
(whether imposed by statute or otherwise) and at its discretion, TfL 
agrees that it will alert the Commissioner to potential breaches of 
the legislation she regulates discovered whilst undertaking its 
statutory duties, and provide relevant supporting information. 


Subject to any legal restrictions on the disclosure of information 
(whether imposed by statute or otherwise) and her discretion, the 
Commissioner agrees that she will alert TfL to any potential 
breaches of the relevant legislation it regulates, or information 
relevant tọ the aims set out at 12 to 14:above, discovered whilst 
undertaking her statutory duties, and provide relevant supporting 
information. 


Subject to any legal restrictions on the disclosure of information 
(whether imposed by statute or otherwise) and at their discretion, 
both parties will: 


e Communicate regularly to discuss matters of mutual interest 
(this may involve participating in multi-agency groups to 
address common issues and threats); and 


e Consult one another on any issues which might have 
significant implications for the other organisation. 


Sharing information 


18. 


19. 


Subject to any disclosure restrictions applicable to TfL, it may at its 
discretion disclose confidential information to the Commissioner to 
facilitate the carrying out of a statutory function of TfL or a 
statutory function of the Commissioner, as set out in 6 to 14 above. 


Where TfL wishes to disclose to the Commissioner information 
necessary for the discharge by the Commissioner of her functions 
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20. 


21: 


22; 


23. 


24. 


25. 


26. 


under the DPA (or under FOIA), section 58 DPA provides that no 
enactment or rule of law prohibiting or restricting the disclosure of 
information shall preclude TfL from furnishing such information to 
the Commissioner. 


In respect of information obtained by or furnished to the 
Commissioner for the purposes of her functions under the 
Information Acts, it is an offence under section 59 DPA for any 
current or former member of the Commissioner’s staff or her agent 
to disclose such information without lawful authority. 


Section 59(2)(e) DPA provides that a disclosure by the 
Commissioner of information obtained by or furnished to her is 
made with lawful authority where, having regard to the rights and 
freedoms or legitimate interests of any person, the disclosure is 
necessary in the public interest. 


In addition, section 59(2)(d) DPA provides that a disclosure of 
information by the Commissioner is made with lawful authority 
where the disclosure is made for the purposes of any proceedings, 
whether criminal or civil. 


Section 59(2)(c) of the DPA provides that a disclosure by the 
Information Commissioner of information obtained by or furnished: 
to her is made with lawful authority where the disclosure is made 
for the purposes of, and necessary for, the discharge of any 
functions under the Information Acts (in this case the DPA). 


The Commissioner may, at her discretion and in accordance with 
sub-sections 59(2)(c), (d) and/or (e) DPA, disclose confidential 
information to TfL, where this is necessary for performing the 
functions set out at 6 to 14 above. 


If information to be disclosed by the Commissioner was received by 
her in the course of discharging her functions as a designated | 
enforcer under the Enterprise Act 2002, any disclosure shall be 
made in accordance with the restrictions set out in Part 9 of that 
Act. 


Where a request for information is received by either party under 
the DPA or FOIA, the recipient of the request will seek the views of 
the other party as described in the FOIA section 45 Code of 
Practice, where the information being sought under the request 
includes information obtained from, or shared by, the other party. 
However the decision to disclose or withhold the information 
remains with the party in receipt of the request. 
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27. Information transfers will be protected in accordance with the 
sensitivity of the information and any classification that is applied. 
Where there is a clear need to reinforce the ‘need to know’ 


principle, then material should be marked as OFFICIAL - SENSITIVE 


or TfL RESTRICTED, as the case may be and protected accordingly 
and in line with the government security classification scheme or 
TfL’s Information Security Classification Standard. It is not 
anticipated that material classified as SECRET or above would be 
exchanged with reference to this Memorandum. 


28. Whilst this Memorandum is written with current legislative 
requirements in mind, the broad principles will continue to apply 
until reviewed in line with paragraph 2. 

Points of contact 


29. See details set out below: 


Information Commissioner 
Emma Bate, General Legal 
Counsel 


Transport for London 
Richard Bevins, Head of 
Information Governance and 
Data Protection Officer 


TfL Information Commissioner 
(Sianature) (Signature) 
2¢, Dow 248 
(Date) (Date) 
Ol TT Aa lò 


